@ai-ecoverse/slicc-kernel 1.171.0 → 1.172.1

package/dist/types/node.d.ts

@@ -2,15 +2,16 @@ import { type MessagePort, type Worker } from 'node:worker_threads';
 import type { CdpHook } from './cdp/types.js';
 import type { CronClock } from './cron/clock.js';
 import type { FacadeSpecs } from './facade/types.js';
+import type { Attestation, AttestTombstone } from './fs/attest.js';
 import type { DenialHook } from './fs/dac.js';
 import type { Protection } from './fs/protect.js';
 import { type UsersMode } from './fs/types.js';
-import type { ConnectOptions, KernelGroups, KernelIntegrity, KernelUsers, RunOptions, RunResult, Terminal, TerminalOptions } from './index.js';
+import type { ConnectOptions, KernelGroups, KernelIntegrity, KernelSealed, KernelUsers, RunOptions, RunResult, Terminal, TerminalOptions } from './index.js';
 import type { ClipboardHook } from './kernel/clipboard.js';
 import { type EmbedderHook } from './kernel/embedder.js';
 import type { RouteTable } from './kernel/net/routes.js';
+import { type SealedOption } from './kernel/net/sealed-fetch.js';
 import type { NetworkUplink } from './kernel/net/uplink.js';
-import type { SealedHook } from './kernel/sealed.js';
 import type { FetchLike, HostfsGrantHook } from './mount/hostfs.js';
 import type { MountEntry, MountSpec } from './mount/mount-fs.js';
 import type { ProcessMountPolicy } from './mount/syscall.js';
@@ -21,10 +22,12 @@ import { type NetworkTransport } from './transport.js';
 export type { CdpConnection, CdpHook, CdpRequest } from './cdp/types.js';
 export { type AttachOptions, attachKernel, type ClientEnded, type ClientFetchRequest, type ClientFs, type ClientRunOptions, type ClientRunResult, type ClientTerminal, type ClientTerminalOptions, KernelCallError, type KernelClient, KernelGoneError, type ProcessEntry, type SpawnedProcess, type SpawnOptions, type WatchChange, } from './client/attach.js';
 export type { FacadeConnection, FacadeHook, FacadeInfo, FacadeSpec, FacadeSpecs, } from './facade/types.js';
+export type { Attestation, AttestedDir, AttestOptions, AttestTombstone } from './fs/attest.js';
 export type { Denial, DenialHook } from './fs/dac.js';
-export type { ConnectOptions, Ended, KernelGroups, KernelIntegrity, KernelUsers, NetworkUplink, ResolveAnswer, ResolveFamily, RouteTable, RunOptions, RunResult, Terminal, TerminalOptions, TerminalSignal, } from './index.js';
+export type { ConnectOptions, Ended, KernelGroups, KernelIntegrity, KernelSealed, KernelUsers, NetworkUplink, ResolveAnswer, ResolveFamily, RouteTable, RunOptions, RunResult, Terminal, TerminalOptions, TerminalSignal, } from './index.js';
 export type { ClipboardHook, ClipboardStamp } from './kernel/clipboard.js';
 export type { EmbedderHook, EmbedderKindPolicy, EmbedderReply, EmbedderRequest, EmbedderStamp, } from './kernel/embedder.js';
+export { SEALED_FETCH_VERSION, type SealedFetchHook, type SealedFetchRequest, type SealedOption, } from './kernel/net/sealed-fetch.js';
 export type { SealedAbortReason, SealedCaller, SealedHook, SealedRequest, } from './kernel/sealed.js';
 export type { ConnectorStamp } from './kernel/socket.js';
 export type { HostfsEvent, HostfsGrant, HostfsGrantHook, HostfsPortGrant, HostfsTransport, } from './mount/hostfs.js';
@@ -58,7 +61,7 @@ export interface NodeKernelOptions {
     hostname?: string;
     users?: UsersMode;
     onDenial?: DenialHook;
-    sealed?: SealedHook;
+    sealed?: SealedOption;
     clipboard?: ClipboardHook;
     requests?: EmbedderHook;
     approve?: ApproveHook;
@@ -84,6 +87,11 @@ export interface NodeKernel {
     readFile(path: string): Promise<Uint8Array>;
     chmod(path: string, mode: number): Promise<void>;
     readonly integrity: KernelIntegrity;
+    readonly sealed: KernelSealed;
+    attest(path: string): Promise<Attestation>;
+    attest(path: string, options: {
+        absent: 'allow';
+    }): Promise<Attestation | AttestTombstone>;
     connect(options?: ConnectOptions): Promise<MessagePort>;
     readonly users: KernelUsers;
     readonly groups: KernelGroups;

package/dist/types/sealed-relay.d.ts

@@ -1,6 +1,7 @@
+import { type SealedFetchHook, type SealedFetchRequest } from './kernel/net/sealed-fetch.js';
 import type { SealedHook, SealedRequest } from './kernel/sealed.js';
 export interface SealedPort {
-    postMessage(message: unknown): void;
+    postMessage(message: unknown, transfer?: Transferable[]): void;
 }
 export interface SealedAsk {
     id: number;
@@ -15,12 +16,21 @@ export interface SealedAbort {
     id: number;
     reason: unknown;
 }
+type WireRequest = Omit<SealedFetchRequest, 'bodyStream'> & {
+    streamed?: true;
+};
+export interface SealedFetchAsk {
+    req: WireRequest;
+    port: MessagePort;
+}
 export declare function sealedAsker(port: SealedPort): {
     hook: SealedHook;
+    fetch: SealedFetchHook;
     answer(reply: SealedReply): void;
 };
 export interface SealedAnswerer {
     handle(data: unknown): boolean;
     close(): void;
 }
-export declare function sealedAnswerer(port: SealedPort, hook: SealedHook | undefined): SealedAnswerer;
+export declare function sealedAnswerer(port: SealedPort, hook: SealedHook | undefined, fetchHook?: SealedFetchHook): SealedAnswerer;
+export {};

package/dist/types/serve.d.ts

@@ -1,4 +1,5 @@
 import { type LockManagerLike } from './client/protocol.js';
+import type { AttestOptions } from './fs/attest.js';
 import { type MetaStore } from './fs/meta.js';
 import { type ProtectInit } from './fs/protect.js';
 import { type UsersMode } from './fs/types.js';
@@ -42,6 +43,7 @@ export interface InitRequest {
     protect?: ProtectInit;
     denials?: boolean;
     sealed?: boolean;
+    sealedFetch?: boolean;
     clipboard?: boolean;
     requests?: Record<string, EmbedderKindPolicy>;
     approve?: boolean;
@@ -148,6 +150,7 @@ export type AttestRequest = {
     id: number;
     op: 'attest';
     path: string;
+    options?: AttestOptions;
 } | {
     id: number;
     op: 'chmod';
@@ -172,7 +175,11 @@ export interface FileChanged {
         path: string;
     };
 }
-export type KernelRequest = AttestRequest | InitRequest | RunRequest | OpenTerminalRequest | TerminalRequest | ConnectRequest | UsersRequest | MountRequest | DialRequest | RoutesRequest | TraitsRequest;
+export type KernelRequest = {
+    id: number;
+    op: 'sealed-placeholders';
+    list: readonly string[];
+} | AttestRequest | InitRequest | RunRequest | OpenTerminalRequest | TerminalRequest | ConnectRequest | UsersRequest | MountRequest | DialRequest | RoutesRequest | TraitsRequest;
 type WithoutId<T> = T extends unknown ? Omit<T, 'id'> : never;
 export type KernelCall = WithoutId<KernelRequest>;
 export declare function inOpfs(deps: ServeDeps, root: FileSystemDirectoryHandle): Promise<boolean>;

package/dist/types/testing.d.ts

@@ -1,7 +1,10 @@
 import type { RouteTable } from './kernel/net/routes.js';
 import { type NetworkUplink, type ResolveAnswer, type ResolveFamily, type UplinkConn, type UplinkDatagram, type UplinkDial, type UplinkMessage, type UplinkUdp, type UplinkUdpOpen, type UplinkUnreachable } from './kernel/net/uplink.js';
 export { type CronClock, type FakeCronClock, fakeCronClock } from './cron/clock.js';
+export { placeholderFloor } from './kernel/net/placeholder-floor.js';
+export { sealedFetcher } from './kernel/net/sealed-fetch.js';
 export { setTestSyscallHook, type TestSyscall, type TestSyscallHook, } from './kernel/test-hooks.js';
+export { sealedAnswerer, sealedAsker } from './sealed-relay.js';
 export type { NetworkUplink, ResolveAnswer, ResolveFamily, RouteTable, UplinkConn, UplinkDatagram, UplinkDial, UplinkMessage, UplinkUdp, UplinkUdpOpen, UplinkUnreachable, };
 export type FakeDatagramPeer = (bytes: Uint8Array) => Uint8Array | readonly Uint8Array[] | {
     error: string;

package/dist/types/transport.d.ts

@@ -21,6 +21,7 @@ export interface TransportServer {
     answer(call: TransportCall): void;
     close(): void;
 }
-export declare function serveTransport(peer: TransportPeer, transport: RealmTransport, { closeWaitMs }?: {
+export declare function serveTransport(peer: TransportPeer, transport: RealmTransport, { closeWaitMs, attributed, }?: {
     closeWaitMs?: number;
+    attributed?: boolean;
 }): TransportServer;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-kernel",
-  "version": "1.171.0",
+  "version": "1.172.1",
   "description": "SLICC's wasm-realm kernel: run Emscripten programs in the browser against OPFS, with fork, spawn, pipes and waitpid",
   "type": "module",
   "license": "Apache-2.0",
@@ -89,7 +89,7 @@
     "@ai-ecoverse/wasm-tar": "1.35.0-9",
     "@ai-ecoverse/wasm-tls-engine": "4.2.0-12",
     "@ai-ecoverse/wasm-util-linux": "2.42.4-7",
-    "@biomejs/biome": "2.6.2",
+    "@biomejs/biome": "2.6.3",
     "@types/node": "26.6.5",
     "acorn": "8.19.0",
     "esbuild": "0.28.2",